Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. ×
Security Businesses

New Targeted E-mail Attack Hits Business Execs 100

Erik Larkin writes "The same scammers who have been sending out the faked but highly convincing BBB and IRS e-mails are now targeting named victims with a new variety of e-mail that looks like a business invoice. Our editor-in-chief was sent one here at PC World."
This discussion has been archived. No new comments can be posted.

New Targeted E-mail Attack Hits Business Execs

Comments Filter:
  • by Realistic_Dragon ( 655151 ) on Saturday June 16, 2007 @09:10AM (#19531709) Homepage
    Finally, a profitable application of the peter principle.
  • It's about time... (Score:4, Interesting)

    by eneville ( 745111 ) on Saturday June 16, 2007 @09:14AM (#19531729) Homepage
    I think it would be wise for companies to switch to use something like GPG and keep keys safe. The sooner this happens the sooner scammers will have a more difficult job with this style of social engineering.
    • Re: (Score:2, Insightful)

      by Anonymous Coward
      Not going to happen.

      Best practice or not, it simply will. not. happen.
      • Re: (Score:2, Funny)

        by eneville ( 745111 )

        Not going to happen.

        Best practice or not, it simply will. not. happen.

        i don't see why not. i'm thinking i might implement this at work next week, we can easily put our public key on the "about us" page as a matter of customer protection against fraud. it's not a big deal to sign all out outgoing mail. its not something that could have any problems, if antthing, i've noticed the mere signing of email causes outlook to put a nice rosette against the mail, so it can't possibly cause any problems for us.

        • Simple. Managers and "high tech" like encryption. Add that the same applies to their business partners and you'll see why it can't fly.

          First of all, it would be a lot of work to convince your managers that it's necessary, and you're putting your job at risk with it, too. The reason is simple: You will be responsible when something bad happens regardless. And it will. Because you said it's safe. Not to mention that you put burden on your manager, someone who can make your life rather miserable quite easily,
  • by yohanes ( 644299 ) on Saturday June 16, 2007 @09:24AM (#19531789) Homepage Journal
    It is still using the same method. The only difference is that they don't include spelling/grammar errors, and uses correct recipient and business name (how hard is that to find?). They are still using the same ".doc.exe" file names, which is very easy to spot.
    • You don't need doc.exe files names people have sent faked bills and some Business end up paying them.
      • Re: (Score:3, Informative)

        by Anonymous Coward
        Faked bills is an old scam.

        Similar to this one...

        -Years ago, we used to have guys that would come to "check" the fire extinguishers in the office.
        -They would do their thing, and wait for the receptionist to pay from petty cash.
        -Only problem... They weren't OUR fire extinguisher guys.
        -We sometimes would get guys coming around every other week. /blah, blah, profit

    • by rucs_hack ( 784150 ) on Saturday June 16, 2007 @09:37AM (#19531853)
      No, no it isn't easy to spot.

      Not if either of two conditions apply.

      1: You are an idiot with computers.
      2: The default 'do not show file extensions for known file types' is on for explorer.

      Whoever thought that last was a good plan should have been shot. Without file extensions visible, people can simply not realise that they are about to run an executable. Plus some wouldn't know all the many executable file extensions for windows anyway.
      • by jez9999 ( 618189 ) on Saturday June 16, 2007 @09:47AM (#19531925) Homepage Journal
        2: The default 'do not show file extensions for known file types' is on for explorer.

        Whilst this is annoying (I disable it as I like to SEE my files' extensions), it doesn't prevent you checking for 'trick' filenames, actually. Any filename that appears to have an extension ('mywork.doc') has a double-extension, so you should be VERY suspicious.
        • Re: (Score:2, Insightful)

          Yes, but the ordinary user (exactly the type of user that is likely to have file extensions hidden) will probably not realize this. They have seen extensions in some places, and none in others - they'll simply ignore this potential giveaway.
        • In any case, even if the extension is hidden, you usually know what filetype it is by the icon. An exe won't have the same icon as a word doc file, and these people who get real doc attachments see the icons for word doc files all the time so they should be suspicious if the file they're opening doesn't have it.
          • Re: (Score:3, Informative)

            by Opportunist ( 166417 )
            Actually those files do have the word .doc file standard icon. Unless, of course, it's a .pdf.exe, in that case it will have the standard Adobe Acrobat one.

            It's trivial to add an arbitrary icon to an executable. Actually, that's a feature of pretty much every standard compiler on Windows.
      • Re: (Score:3, Insightful)

        by dubbreak ( 623656 )

        The default 'do not show file extensions for known file types' is on for explorer.

        That shouldn't even matter. Why can they run anything? Why is Outlook allowing them to open exe files?

        If #1 is true (it is where I work, a gov agency, different country), then don't let them make decisions on whether to open a file, have the system do that. You don't let mentally retarded people drive a car, so why let you average idiot choose what to run on a computer?

        • Why is Outlook allowing them to open exe files?

          Because saving it and executing it from explorer is first of all actually a non-trivial task for those people and it wouldn't help at all.

          Imagine file extensions are turned off. So bogus_file.doc.exe is shown as bogus_file.doc, and has a Word-document like icon. When that file is now saved, it will appear as bogus_file.doc in the explorer.
        • by yuna49 ( 905461 )
          Even more pertinent, why is the mail system set up to deliver executable files to users in the first place?

          Every system I've ever installed for clients blocks executables at the server and puts them into quarantine. Occasionally some doofus, sadly usually some IT consultancy, wants to send an .exe file with patches, updates, etc. (I'm always amazed how often these people say that we're the only ones who don't accept executables by default. What kind of consultants are they?) Usually the IT manager has w
          • Excellent point. There is no reason to send any exe by email in a corporation. If necessary for some reason, then it should be posted on the intranet somewhere and only a link sent via email. Allowing any exe to come in via email from externally makes no sense.
      • by canUbeleiveIT ( 787307 ) on Saturday June 16, 2007 @10:13AM (#19532073)

        Not if either of two conditions apply.

        1: You are an idiot with computers.
        2: The default 'do not show file extensions for known file types' is on for explorer.

        But these are the same people who click "Allow" when their software firewall says "H4xoR!tR0jun.exe is attempting to access the Internet, install a malicious script, steal your personal information and have sex with your wife until she screams like a deaf girl. Permit or Allow?" There is no way to protect these people and still have their computers be useful/enjoyable for them.
        • You don't need to. (Score:5, Insightful)

          by khasim ( 1285 ) <brandioch.conner@gmail.com> on Saturday June 16, 2007 @10:46AM (#19532351)

          There is no way to protect these people and still have their computers be useful/enjoyable for them.

          You don't need to.

          As long as the protections cause the rate of infection to drop below the rate of disinfection, the threat will fade.

          Social engineering will always be an issue. Even intelligent people can make mistakes.

          The idea is to make it as obvious as possible that this is a DANGEROUS activity ...and then...
          Make it as easy as possible to clean up the mess.

          #1. Any time an application is launched by clicking on a file INSTEAD of going through the menu bar throw up a warning.

          #2. No email program should EVER run ANY executable.

          That is the primary reason that so few "viruses" exist in the wild ... for Linux. Running Ubuntu in the default configuration means that you have to:

          #1. Save the attachment to your personal directory.

          #2. Change the permissions on the file to be executable.

          #3. Run the file.

          And even with all of that the only thing in danger are your personal files (you do back them up of course). To do anything more you'd have to...

          #4. Suppy it with your sudo password.

          The reason this is so successful is that the possibility of FAILING to run the "virus" goes UP with each step that is required. Say that each step only has a 50% possibility of being run by the average user. The other 50% of the time they realize that they're doing something dangerous and they stop.

          A. Old Windows example:
          #1. Double-clicking on "sex.gif" in an old version of Outlook is a single step and will succeed with 50% of the people.

          B. Linux example:
          #1. Saving the file to your personal directory will work with 50% of the people.

          #2. Changing the permissions on the file will work with 50% of the people from step 1 (25% of the total).

          #3. Clicking on the file will work on 50% of the people from step 2 (12.5% of the total)

          #4. Supplying the sudo password will work on 50% of the people from step 3 (6.25% of the total).

          So, 50% infection rate vs a 93.75% NON-infection rate.
          • #1. Any time an application is launched by clicking on a file INSTEAD of going through the menu bar throw up a warning.

            This just worsens the problem. If you throw warnings and dialog boxes at people constantly, then they just stop reading them, and always click "Ok" or "Yes." It's not just a terrible idea, it's actually counterproductive. It's a massive problem with Windows, which seems to throw dialog boxes at you every 5 seconds for the most trivial of operations. I've seen "Are you sure you want to do the command you just asked me to do" boxes on the most stupid things.

            • by FJGreer ( 922348 )
              Unfortunately the only way to decrease the incredible urge most computer users have to open things they ought not to is to have companies require their users to take "Computers for Dummies" courses, and if they don't learn at least something about how their computers work they should be fired on the spot. Or just make them switch to OS X or Linux or What-Have-You where it takes a lot of hard work to screw up your computer. And at least until the virus writers get smart about linux and mac malware (it CAN
            • For reference, see Vista and pretty much ever "learning" personal firewall.

              The only thing people noticed when those "pesky" popups appear is that whatever they want to do only works if they say "allow" all the time. So when in doubt, they will "allow". Reason: They learned that their network suddenly stopped working after a windows update where some DLL got changed which was a necessity to make the DNS service work, but they said "deny" when it tried to contact the DNS server.

              Learning effekt: Better say yes
          • Let's imagine for a moment we got those people to use Linux instead of Windows.

            They get a mail, claiming the attachment enables them to run HD content under Linux, it's some supersecret, hacked AACS key thingamajig, the text makes it look like it was supposed for someone else so the lucky winner of the HD player thinks he hit the jackpot.

            Included are detailed instructions what you got to do to make it run, which includes sudo'ing.

            Bet you my computer against an abacus that it will work. The security of a sys
        • Re: (Score:3, Funny)

          by Tunfisch ( 938605 )
          I'd tend to say that choosing between "Permit" and "Allow" is tough for just about anyone.
          • "$program just tried to access $address on port $port, allow or deny?"

            Well, what would you click? No, I won't provide info what program tried to access what address on what port, because the sentence above is exactly the information an untrained user gets out of the message! The only information he has is that something tried to do something with a server somewhere on the 'net. Is it a system dll that does some periodic check of something? Is it a scheduled task (ok, he won't even think of that)? Is it a tr
        • by guywcole ( 984149 ) on Saturday June 16, 2007 @11:02AM (#19532483) Homepage Journal

          But these are the same people who click "Allow" when their software firewall says "H4xoR!tR0jun.exe is attempting to access the Internet. Permit or Allow?"
          If those are the only two options, can you really blame them?
        • Re: (Score:2, Funny)

          by MrR0p3r ( 460183 )

          But these are the same people who click "Allow" when their software firewall says "H4xoR!tR0jun.exe is attempting to access the Internet, install a malicious script, steal your personal information and have sex with your wife until she screams like a deaf girl. Permit or Allow?"

          That is one hell of a descriptive (albeit true) firewall advisory message. What software firewall are you using?
      • by Anonymous Coward
        Arrogant bastard. There you /.'ers go calling people who don't 'know' as much as you idiots. Get a life and a clue, you don't know everything. If you did, you wouldn't be posting on /.

      • by frisket ( 149522 )
        Hell, it might help cull the current crop of dorks who inhabit Executive Row.
        1. What kind of dickhead opens a .doc or .doc.exe attachment anyway? (See first post)
        2. If you do business with dickh^H^H^H^H^Hpartners who send their invoices as .doc files, you're going to get what you deserve anyway.
        • Hey, it's fun to read the changes. With a hint of luck you'll see just how low they'd go 'cause the original creator of the document wrote his limit in and the boss just changed that to the "let's see if they swallow it" amount. :)
  • Maybe if a spam scam starts affecting businesses, or the wealthy, there will be a better chance that the politicians will wake up and do something about spam.
    • I'm pretty sure no amount of money protects the wealthy from the overwhelming amount of crap on the internet. Spammers do not discriminate.
    • On the whole, do you think business has a positive or a negative effect on society?
  • by arthurpaliden ( 939626 ) on Saturday June 16, 2007 @09:49AM (#19531937)

    and before that they used the regular mail.

    So this is news because .... they used computers .... and .....email.

    • And it is not targeted enough cause they have hit the editor of PC World , they should be more carefull.
    • And it used to work too, because the 'smart ones' would invoice for less than what would've otherwise cost the billed company to find out if the invoice is legitimate or not, so the company simply pay it just to 'make it go away.'
    • "So this is news because .... they used computers .... and .....email."

      Looks like it has all the components to be patentable.
      • Can you patent a scam as a business process? Then once the police catches the fraud artist you can then sue him/her for patent infringment and so long as they still have money left take it as a settlement.
    • by vidarh ( 309115 )
      RTFA. This is _not_ about sending fake invoices, but about sending spam e-mails with malicious apps masquerading as attached invoices.
    • They used computers? On the internet? Slap a patent on that baby it's bound to be a money maker!
    • They used to do it with faxes, and before that they used the regular mail.

      Ok, I can see how regular mail could be used to spread viruses, but faxes? Are we talking about a Snowcrash scenario here?
  • by swb ( 14022 ) on Saturday June 16, 2007 @09:53AM (#19531951)
    Many companies have good controls, but many have loose controls on paying invoices. If you used a reasonable database and chose businesses who might get a lot of bills but have a weak grasp on them, you could probably come up with a formula that would correlate highly with having randomly mailed invoices get paid.
    • by u38cg ( 607297 )
      The really at-risk group are growing companies who are getting just beyond the stage where the person inputting the invoice knows the business well enough to sanity-check it, but haven't yet put in place decent procedures for authorising invoices. Happily, it only takes a couple of stupid mistakes to be caught before such procedures are introduced.
      • by swb ( 14022 )
        I suspect there's many risk factors. Think of smaller companies with field offices -- often the bills for field office services go to the home office, and the person paying the invoice has little idea what the services are but knows the risk of not paying them may be disruption to the field office.

        It also helps to keep the amounts small as well as perhaps add a late payment charge, so the person getting the bill is worried they might be in trouble if they make the bill late.

  • by 26199 ( 577806 ) * on Saturday June 16, 2007 @09:55AM (#19531967) Homepage

    Doesn't help in the slightest.

    Don't people know by now that the 'from' address can be easily changed?

    (That was a rhetorical question; they answer is evidently 'no'.)

    • by jez9999 ( 618189 )
      Of course the From address can't be faked. It's just like envelopes. Do you think that the return address on the back of an envelope can be faked?
      • by 26199 ( 577806 ) *

        Er. The question was "don't people know that it can be faked", to which the answer was "no"; meaning no, people don't know that it can be faked, not, no, people don't know that it can't be faked.

        Sorry for the confusion. But, to be clear, I do know that it can be faked. It's just most people don't.

        • by jez9999 ( 618189 )
          I was, in fact, being incredibly sarcastic. Didn't work very well over the net.
          • by 26199 ( 577806 ) *


            That was my first thought, but then I realised there actually was potential for confusion, and you didn't give any sarcasm hints ;)

    • Recently a wave of "P2P lawsuit" spam mails flooded the servers around the globe, claiming the attachment is a court order (yes, that alone is enough stupidity).

      The from-address read: "Lawyer". No name, no address, no reply-to address, just "Lawyer". And people fell for it in heaps.

      People are stupid. Deal.
  • by dachshund ( 300733 ) on Saturday June 16, 2007 @10:06AM (#19532021)
    The PC World article doesn't go into a lot of detail. Here's some more. The malware itself looks pretty silly, since you have to click through a bunch of warning dialogs to even execute it.

    http://avinti.com/press-room/targeted-malware-atta ck.html [avinti.com]
      • by pe1chl ( 90186 )
        When the executable is run it downloads a new .exe and .dll from multiple hosts. The malware appears to be hosted on many machines, as the IP addresses are always different and are located in several countries, including the United States, China, Canada, and Romania. The downloaded malware attempts to find shares on the local network in order to create files. The process registers itself with the system to guarantee future runtime as well as getting hooked into standard operating system files.

        Ok, so to infe
  • Small business owner (Score:5, Informative)

    by narced ( 1078877 ) on Saturday June 16, 2007 @10:07AM (#19532025) Journal
    As a small business owner, I can attest to the fact that many of my clients will blindly pay the bills I send them, without questioning a thing. I service their computers throughout the month, racking up between 10 and 30 hours, and then send them a bill that simply says "30 hours service * $60.00 / hour" and they pay it. I have never been asked to explain myself. I can probably make up whatever numbers I want.

    I was wondering how long before the crooks realized that most businessmen do not have the time or patience to study their bills.
    • by Anne Thwacks ( 531696 ) on Saturday June 16, 2007 @10:10AM (#19532057)
      You are obviously not in the UK. Here the problem is that you do the work, send the bills, and still don't get paid!
    • When I was a small business owner, I used to get:

      - Fake invoices from "phone books" for ads (that said in tiny little print that it was not a bill, thereby making it legal rather than mail fraud.)
      - Phone calls from someone claiming to be my regular supplier of printer or copier supplies, offering to sell them "before the price goes up"
      - Similar phone calls to the last for air hoses and a variety of other industry-specific stuff.

      The new thing here appears to be that, rather then profi
      • by dbcad7 ( 771464 )
        The major ones I've noticed are Toner, and light bulbs.

        These people obtain a name of an employee, and just send it, with the unsuspecting employees name as a PO. Then they bill it, hoping accounts payable will just pay it.

  • I just wanted to try out how likely it would be for me to accidentally open a .doc.exe file, immediately after renaming a .exe file to .doc.exe, AVG was onto it. Since we use AVG on our computer shop systems, I'm reasonably sure that with having that Antivirus and Thunderbird, this sort of scam won't get far with us. Well, that and the fact that we are always in close communication with the BBB to begin with, so if we get a strange email from them, we can always ask them if they sent one.
  • by Anonymous Coward on Saturday June 16, 2007 @10:21AM (#19532127)
    I am a VP for HR at a giant multi-national technology corporation and I just sent all of my post-dated stock options to someone in Nigeria so that I could give a puppy a good home.... well, the puppy never showed up and I need some help to get my $6,000,000 back. Won't you please help?
  • Hard work (Score:5, Insightful)

    by Ajehals ( 947354 ) <a.halsall@pirateparty.org.uk> on Saturday June 16, 2007 @10:21AM (#19532139) Homepage Journal
    This spam includes a valid email address for the recipient, and correct recipient name and business details. The message and attachment could be anything. In this case its an invoice, but it could just as easily be an order (sent to sales) or a request for info (sent to PR or Marketing). This would make it extremely difficult to identify.

    Its not as if you could use heuristic scanning of the text content (any malicious payload excepted) to determine that messages of this sort are spam, it would prevent you from recieving any business related email that follows a similar formula and they are all pretty similar.

    The attachment in this case was a doc.exe which is fairly obviously dodgy, but as the article states it could be a .doc (or presumably a file for any application that is exploitable by opening a file) to take advantage of a zero day vulnerability.

    With this type of spam and the zero day vulnerability as the scenario it would be entirely possible for a message like this to get through to a real person, for that person to open the attachment and execute whatever malicious code is embedded in the attachment without realising that they have even done anything strange.

    There is no way of preventing it that still allows your employees to function, with a 0 day you are (probably) not going to detect the payload before it is executed (what happens then depends on what precautions your company is taking). You cannot brief your user base not to open emails addressed to them with content that looks valid and may be part of their job to look at, the argument of only opening mail from people you know only really works in a social context where you can afford to ignore mail.

    So, up until now most common scams and viral mail have had some tell-tale characteristics (although by no means all, custom attacks against specific targets have followed this model before), and now they may not have. (I never understood why spam was so poorly produced in any case). Given that even badly written and almost blindingly obvious spam and scams manage to trick a small number of people, this type of spam or scam is likely to be more effective. This leads me to think that from a business point of view (lets be honest, especially a Microsoft shop) the usefulness of email is seriously deteriorating, it is approaching the point where the existing system contains too much risk and is too overburdened to be useful and that is saying a lot because email really was/is a revolutionary technology. Not that I can think of an alternative nor am I suggesting that we will see business dropping email, but I can see business looking at some of those fatally flawed but great sounding add-ons that aim to secure mail from unknown recipients (micro payments and white listing etc..).
    • by vidarh ( 309115 )
      There is no way of preventing it that still allows your employees to function,

      Yes there is. By default sequester all downloaded content to a sandboxed environment with very limited access rights to anything (such as no access to other files, and no access to the network without being given explicit permission for every action). Making functionality to make that trivial to do would be a killer app for virtualization technology. For most users, having a shared clipboard to cut and paste data, images and o

      • by Ajehals ( 947354 )

        By default sequester all downloaded content to a sandboxed environment with very limited access rights to anything (such as no access to other files, and no access to the network without being given explicit permission for every action). Making functionality to make that trivial to do would be a killer app for virtualization technology.

        My point is you are going from a useful technology i.e.
        1) get email, it has a power point attachment, Open the power point attachment, modify it save it send it back...
        2) get an email, have it quarantined, now you cannot do anything with it.
        After all accessing it with a suitable reader application would threaten that application, if you are suggesting running the application that opens the attachment in a sandboxed environment then you need to realise that things like external media sources embedded in fil

  • by Telecommando ( 513768 ) on Saturday June 16, 2007 @11:11AM (#19532579)
    In nature, the successful predator always goes after the weak and the lame first.

    Where I work we had to implement draconian measures concerning attachments and files because the execs kept clicking "run anyway" even though the anti virus software warned them it could be an infected file. They honestly thought they knew more than the AV software.
  • Now they're tageting the most intellectually vulnerable of society.
  • Good Thing? (Score:4, Interesting)

    by Bob9113 ( 14996 ) on Saturday June 16, 2007 @11:28AM (#19532777) Homepage
    At the risk of sounding a little jaded and anti-establishment (which would surely make me an outcast on this site, haha):

    I think maybe this is a good thing. I think the scammers have been, to this point, largely targeting the gullible. Old people, drug abusers, the socially awkward. The problem with that is those sections of our society are, I would guess, significantly underrepresented in the political process.

    If the friends and contributors of our ruling elite class start getting tagged, perhaps we will see some Internet legislation that is focused on taking out the really vile scum, instead of just the low grade malefactors that infringe copyright for personal use. Copyright legislation is going gangbusters because the people Congress talks to believe it is good. If those same people start to feel the bite of scammers, maybe they'll get serious about finding these assholes and putting them away.
    • Well, while it would be a good thing if we got more sensible laws, do you think that's what would happen if this actually got pumped towards congress? I mean, you've seen what BS came out of there recently, right?

      We'd probably get some new unenforcable laws, or insane punishments on existing unenforcable laws, and on top of it some laws that won't even address the issue but make the life of the whitehats even more uncomfortable than it already is, to the point where the only one who'll still be able to dete
  • I won't believe it. I think these were probably the same painfully obvious scams that I get every day.
  • by httptech ( 5553 ) on Saturday June 16, 2007 @12:17PM (#19533239) Homepage
    I've noticed some comments to the effect that it's easy to spot because it is a .doc.exe extension on the attachment. Not so! The latest runs of these scams have been EXE files embedded within actual MS Word or RTF files. Inside the document is a PDF icon and a note telling the user to click on the icon to view the invoice (or complaint, depending on the scam). This is a different method of social engineering than we usually see. That plus the targeted nature of the emails is what makes this sophisticated. It may not fool the savvy user, but as many execs haven't seen something of this nature before, they are likely to click and open the embedded executable. Most are just trusting their AV to warn them if there is anything wrong with the file, which is a big mistake these days.

    If you work corporate security, make sure you are watching for signs of the data exfiltration on the network. I've written some Snort IDS signatures which are available here:
    http://www.secureworks.com/research/threats/bbbphi sh [secureworks.com]
  • poor guy. his name sounds like spam all by itself.
  • Every business should be required to have a national ID and place that ID on any ads. That would make it much easier to trace crap to the source and filter out any known abusers.
    • So I get a number, and post it in my ad. Someone wants to impersonate me so he copies the number out of my ad (after all, it's of no value if it's kept secret), and uses it to fool people. What has been gained?
      • by Tablizer ( 95088 )
        So I get a number, and post it in my ad. Someone wants to impersonate me so he copies the number out of my ad (after all, it's of no value if it's kept secret), and uses it to fool people. What has been gained?

        If somebody paid money for the ad, it is more likely traceable. Plus, they can do this anyhow now with a company name.
  • The service my company offers is primarily targeted at small to medium businesses. As such I frequently deal with the owners of these companies, and if the issue is technical in nature I have to ask them about their network setup. Simple stuff like "Okay, and what kind of internet connection do you have?"

    It's astonishing how many of them will say things like "I dunno" or "Oh, it's broadband" or "There's a box that says Netgear, does that help?" If they don't know sometimes I press a little: "Well, do y
  • I've seen all sorts of people here comment that email is getting too risky for businesses to use. From where I stand, that's not the real problem. The problem that's at the center of both the malware and spam problems is that it's become very hard to quickly determine the credentials of a person sending you information. In the case of email, the solution to the malware problem is simple: strip out all html tags and attachments off as the mail is received. There is no way to get malware from an email wit
  • Don't forget to file your TPS reports people!

Our business is run on trust. We trust you will pay in advance.